Vulnerabilities in pkg:golang/github.com/anyproto/anytype-heart

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vv3h-7qwr-722v",
  "modified" : "2026-03-24T21:11:53Z",
  "published" : "2026-03-11T15:33:29Z",
  "aliases" : [ "CVE-2026-31863" ],
  "summary" : "Anytype Heart's gRPC API client challenge verification can be bypassed on localhost",
  "details" : "#### Impact\nThe challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code.\n\nAffected components:\n- Anytype Desktop (all platforms) ≤ v0.48.2\n- Anytype-CLI (headless deployments) ≤ v0.1.9\n\nNot affected:\n- Anytype mobile apps (iOS, Android) - do not expose a local gRPC server\n\nWho is impacted:\nThis vulnerability is scoped to localhost. The gRPC and gRPC-Web ports bind to 127.0.0.1 only and are not exposed to the local network or internet.\n\n### Exploitation requires:\n- Local user-level access to the machine running Anytype\n- Discovery of the randomized listening port\n- A running Anytype instance\n\nAnytype-CLI headless deployments may be at higher risk only if an administrator has chosen to set up their own reverse proxy and configured it in a way that\nexposes gRPC or gRPC-Web ports to an external network. **By default, these ports are not externally accessible and there is no built-in mechanism to expose them.**\n\n#### Patches\n- anytype-heart library: v0.48.4\n- [Anytype Desktop](https://github.com/anyproto/anytype-ts): v0.54.5\n- [Anytype-CLI](https://github.com/anyproto/anytype-cli): v0.1.11\n\n#### Workarounds\n- Desktop users: No immediate action required. The vulnerability requires existing local access to the machine.\n- Anytype-CLI administrators: If using a custom reverse proxy, ensure it does not expose gRPC or gRPC-Web ports to external networks.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/anyproto/anytype-heart"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.48.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/anyproto/anytype-cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.1.11"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/anyproto/anytype-heart/security/advisories/GHSA-vv3h-7qwr-722v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-31863"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/anyproto/anytype-cli"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/anyproto/anytype-heart"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/anyproto/anytype-ts"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2026-4680"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-307" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-11T15:33:29Z",
    "nvd_published_at" : "2026-03-11T18:16:25Z"
  }
}